Everything that you save in the Asset folder is available only after it is copied to the internal or external cache directory. Thus, you cannot keep it safe from exploiters at the same time. However, you can save anything in this folder in encrypted form and decrypt it at runtime just before using it.